On October 21, government websites across Europe went dark. Dutch, French, Danish, and Finnish agencies took public-facing services offline after critical vulnerabilities surfaced in #PHP, the programming language behind approximately 75% of websites. The flaws had been sitting in the codebase for years until AI tools uncovered them. Although a fix has been shared publicly, #AI has made it easy for attackers to reverse engineer what changed. Amazon reported that its security team saw an exploitation attempt against a honeypot system on October 17, four days before the disclosure. Defenders were behind even before the advisory went out. In this post, Mark Kuhr and Nabil Hannan answers the broader questions #security teams are asking about how this story illustrates the new normal in offensive security. vmblog.com/bylines/5-questio… #cybersecurity #phpflaw